remcos | 34102f0b2b79b27b821c7d06a88843fd0faf3fb39191bb685015d1ab909f1d4b

General

Target

b5e515f8a8f3839d70776c90f398c490N.exe
Size

139KB
MD5

b5e515f8a8f3839d70776c90f398c490
SHA1

21a6d57c7b72e5c1a60e368dd4a723db65c12e07
SHA256

34102f0b2b79b27b821c7d06a88843fd0faf3fb39191bb685015d1ab909f1d4b
SHA512

6776a38a1fb19a3351e1a50f7efbfa0f1f7bd84ada9e93febaef5a03c41bce94bb4801cb720d4a1d5b4f821f2f2f17c133a9c24c0aaf6ff522460ed03890c81b
SSDEEP

3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIH4:xP6/M+WLckOBhVmIZ

Score

10^/10

remcos host discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

systemcontrol.ddns.net:45000

systemcontrol2.ddns.net:45000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
OfficeUpgrade.exe
copy_folder
OfficeUpgrade
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
Upgrader.dat
keylog_flag
false
keylog_folder
Upgrader
keylog_path
%AppData%
mouse_option
false
mutex
req_khauflaoyr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
OfficeUpgrade
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	b5e515f8a8f3839d70776c90f398c490N.exe

Executes dropped EXE 2 IoCs

pid	Process
3384	wn2ra4ohzdr.exe
1360	wn2ra4ohzdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	b5e515f8a8f3839d70776c90f398c490N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 1360	3384	wn2ra4ohzdr.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5e515f8a8f3839d70776c90f398c490N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1360	wn2ra4ohzdr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 3384	664	b5e515f8a8f3839d70776c90f398c490N.exe	94
PID 664 wrote to memory of 3384	664	b5e515f8a8f3839d70776c90f398c490N.exe	94
PID 664 wrote to memory of 3384	664	b5e515f8a8f3839d70776c90f398c490N.exe	94
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97
PID 3384 wrote to memory of 1360	3384	wn2ra4ohzdr.exe	97

C:\Users\Admin\AppData\Local\Temp\b5e515f8a8f3839d70776c90f398c490N.exe
"C:\Users\Admin\AppData\Local\Temp\b5e515f8a8f3839d70776c90f398c490N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
    "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe

Filesize
139KB

MD5
f7d3cd17f67ff8257ef2cddfaba2e4f2

SHA1
562bd8309216bf5d52081ea96f269644b29a86dd

SHA256
a437443b374c631fc3adc9b5adc59a0a6dd1bd2057f69cd3ec58e216e028e95c

SHA512
d183bc5183ed74e665eb8eeb7478edc454412c81e333b3091a38a28abd6380ae7240c1591ffb60702146de8310962719922693584e08d131e31731004e8cc428

Download Submit
memory/664-20-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/664-1-0x0000000000540000-0x0000000000568000-memory.dmp

Filesize
160KB

Download
memory/664-2-0x0000000005560000-0x0000000005B04000-memory.dmp

Filesize
5.6MB

Download
memory/664-3-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/664-4-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Filesize
40KB

Download
memory/664-5-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/664-6-0x0000000005210000-0x0000000005230000-memory.dmp

Filesize
128KB

Download
memory/664-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1360-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1360-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1360-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1360-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1360-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1360-30-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3384-22-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3384-21-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3384-33-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3384-35-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads